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GENER AL, 

This unit was engaged in the interception end evaluation 
of Russian Army , Army Air, and N . K , W , D .' si gnals on the s out hern 
half of the front from June 1941 until Hay 1945. As a result 
of its work, the Germans were able to obtain an accurate and 
dei ailed picture of the Russian Order of Battle on the front 
covered. They were also able to predict the locality and 
timing of Russian offensives some considerable time before they 
developed. These results' were achieved more by the close 
integration of all available sources of Information than by the 
reading of actual cipher messages, though a large proportion 
of the medium and low grade ciphers used by the Russians were 
in fact read. The rival claims of T/A and crypt -ana lysis 
appear to generate as much heat in the German Army as they do 
in other national organisations j but an unbiased view of the 
answers given by the Ptif's interrogated would probably load to 
the conclusion that in the case of the Russian forces the 
respective value, of general evaluation (T/A, card indexes, etc) 
and pure decodes is about three to one. Thi3 is due to two 
factors : - 

(1) The general unreadability of Russian High Grade 
ciphers, owing to the practically universal use of 
one time pad. 

(2) - The enormous amount of information to be obtained 

from the Russian practice in the use of indicators, 
call-signs, and the generally low though Improving 
standard of Russian wireless discipline. 

Prom the crypt -analytical angle Russian security is based 
almost entirely on the use of one time pads for high grade, and 
a multiplicity of code books and re ciphering tables for medium 
and low ga.de' ciphers . The latter are perfectly straightforward 
in the systems used and their solution deponds almost entirely 
on the availability of sufficient material. Under wartime 
conditions tho Gormans seem, in most cases, to have obtained all 
thoy required. 


EDITO R IAL NOTES. 

Some explanation is no ode a of the form in w hie a the present 
report appears . 

The members of Kommandour der Nachr. Aufkl. 1 (K0NA.1) 
were first discovered at KONSTANTINS BAD, near PIIfiEN, at the end 
of May 1945, There thoy received their first interrogation. 
There Ltn. LOEFFLER wrote his first review of Russian ciphers. 

Then the unit moved to REVIN, in the ARDENNES, where, at 
the instigation of the first interrogators, thirty-one further 
reports wore written by the various Ps./W, some by combined 
effort . 


All tho nv? t 1 ablo were st'vH <=>d toofor»Q the final 

Hit 011*0 cat or a (specialists) pi-..>f>oodod to Revln . Two of tho 
original reports, L03Pi’ l I3R's and HEIiiANN’s (tho latter on 
traffic analysis) wore so elaborated during tho course of tho 
final interrogation that it is purposeless to record in 
translation tho original versions: they are incorporated in 
the critical ro views of Annexes 1 and 2 

Tho remaining 30 reports appear, below, in litoral 
translation. Well as tho prisoners had allocated tasks to 
the individual reporters, there are many passages which overlap. 
Classification -and arrangement was difficult, Annexo 
summarises the contents (insofar as they aro not already covorod 
in Annexes 1 and 2 ) of these reports. 

Specialists develop their own jargon, Translators wore 
obliged to follow that of KONA 1, o.g. Slocknot, cal -number, 
sec -Lint of abbreviations and equivalents , 1 
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— list Of ABBREVIAT 1 ONfc AND EQH IVA LE1?IS — 

Units find author It las (not translated) 

Gen. d. NA. (General dor* Naehrichter.aufklaorung) with 


ii^ 


LNA . 


KONA. 1 


NAAS . 
Posts 10 


(Leitstollo d-r KacAnrichtonaufklaorung ) 

Note: Gen. d. NA , is successor title to LNA * , 
the Sigint. organisation of CKH, 

(Korcmandeur der Nachrichton-Aufklaerung 1); also 
referred to by re/.V as the 'Regiment 1 . A KONA, is 
the Sigint. ’unit of a Gorman Army Group, in this 
case, of Army Group North Ukraine, 

(Nachrichten-Aufklaerungs Auswortestollo ) : the 
Evaluation section of a KONA. 

(Pesto Nachrichton Aufklaerungsstell o 10): an 
originally static, latterly semi -mobile long range 
intercept unit: Company strength, with KONA 1* 


NAFAK S17, 023 (Nachrichton Fornaufklae rungs kompanic 617,623): 

Long Range Sigint, Companies with KONA 1. 


NANAK 954 
Abt. 3,4 


POA,‘ 


( N achrichton N aha: f k.1 ae rungs kompanic 934): Close 
Range Sigint- Company with KONA 1. 

(Nachrl. cht o nau f k loo rung s Ab tolling 3 -4 ) j s t af f s 
r o sp on si b 1 o for* coo r d inat ing the C 1 ! . so Ran go S i g in t , 
effort of Sigint. Regiment ana for cooperation 
with the Armies. 

N.B. The writers of the reports use ’.'btoilung' of 

the Abt o Hunger 3 and 4, and of the subsections 
cryptoanalysts, evaluators etc. with the various 
Sigint. units. Bleaso note that in tho trans- 
lations the word 'section' (used to denote the 
specialist groups) does not imply a sub-unit of 
any specific size. 

German abbreviation for tho Russian 'prontoberkemmaido 
the HQ, of a Russian Army Group. 


Tormino logy (translated, or somi -translated , or not translated). 

aaditivo: Wurm. 

code : Code . 

. key: Schluossel, 

rocipher: Hebe rschiuesse lung, 

stencil : Rust or. 

subs tit ution; Caesar . 

traffic analysis: Funkbe triebs for s chung. 
traffic evaluation* Verkehrsausw ert ung, 

- tra nspos it ion sWucrfol, 

Bloc knot: untransl. — is One -time pad. 

Chi-nummer: Chi- number -- is cipher serial number, 

Chiffrant: not transl. — a recipher element, pr sent in N.K.tf.D 

traffics only. 

, Hauptvort oiler: given as 'Basic book for Allotment or c/s (Haupt- 

vcrteilor . ) ! 


Tn.kav.dTT 


'Grenztruppen . ' Not translated, Aoparently the 
o . A , -l* . in.ocpc which epos ato at ms JuxusgIuXi- 
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-- TABLE Of CONTENTS 


(N.B. The gunoral headings I, II etc., supplied \jy 
editor. ) 

I ORGANISATION of KONA, lj Distribution of tasks. 

Report No. 1 Organisation of K0NA.1, by Major E.HERTZER. 

Report No, ST Organisation of Feste 10, by Obltn, W. KMA IB * 

Report No,' 3 Organisation and Method of Evaluation in 
Company and NAAS., by Ltn. H, POGANSKI. 

Report No, 4, Organisation of an Intercept Station, by 
' Uffz. E. HER38T. 

Report No, 5 Organisation and tasks of crypt -analytic 
section of NAAS.l, by Oborw. K. EICKBOFF. 

Report No, 6 Organisation and tasks of crypt -aanaly tic 
section of a Long Range Sigint. Company, 
by Ltn. H, LOEFFLER. 



II GENERAL method j examples of Evaluation, 


Rep or t No . 7 

Report No ". 8 

Rep oi t K o7~g 

Repo r t No. 10 
Report No, 11 

Report No ,13 

Report No. 15 

Report No. 14 

Rep ort No. lb 

Repor t No. 16 
Rop'ort No'.' 17 


Evaluation, by Hptm. R, ROESSLER. 

Card Index section, by Insp. G. BERGER. 

The attack on an unidentified Russian 
traffic, by tho various Evaluation sections, 
by Ltn. H. BOSKAMP , 

Sigint. Sitrep. 0900/27 /4 - 0 800/28/4, by 
Ltn. 0. SCHWARZ . 

Introduction of a now Front and its effect 
on N.K.W.D., Air and Army traffics, by 
Ltn, E, WOELLNER. 

Example: appearance of a new major formation 

in 1st, Ukrainian rront, by Ltn, 0. SCHWARZ. 
Shifting of Schworpunkt; the northern wing of 
a Front intends to attack, by Ltn. H. POGANSKI. 
Shifting of the boundary between 1st. and 2nd. 
Army, etc., by Ltn. K1 . WEIHE . 

Contribution (in terms of a percentage) of tho 
v arici 1 r mo an s of identification, by No t m. . L 
AGES BLN A ■ 

From personalities card-index, (no signature) 

" unit " " " " 


III TRAFFIC EVALUATION} examples, 


Report No. 18 

Report No. 19 

Report No. 20 

Roport No, 21 

Report N o '.'21 

Report No. 2 3 


Traffic evaluation} identification of traffics, 
byObergofr. G. SCHOLZ. 

Re-identification of a major armoured 
formation withdrawn from Frrnt, by Insp, G, 
BERGER • 

The study of unidentified traffics, by 
Uffz. R, STROHTMANN. 

D/F evaluation, by Ltn. E, JOELLNER. 

Re -identification of individual W/T stations, 
by Uffz, A. GRAUL. 

(Network diagram of) Tank Administration 
of 1st. Ukrainian Front , (unsigned). 
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IV CRYPT- AN A LYSIS, details. 

Report No, 24 Aids to crypt-analysis, by Gefr. E, BAHR. 
Report~No • ~2B Crypt -analysis of 5-figure addit-.ivo oode* 

^ v££Zt H< ALTMS# 

Report No. 2 6 Spring and Pall, change of 5 -figure code, 
by Hptm. R, ROESSIER, 


V N. K, rf. D, traffics. 

Report No. 27 Study of N.K.A.E, traffic, by Ltn. E. 
WoELLNER t 

Report No - 28 Characteristics of N.K.W.D. traffic, by 
Gofr. L. KUCHING, 

Report No. 29 N , K , v i . D , codes, by Ob erge f r , G . THOMAS . 


VI AIR FORCE traffics. 

Report No, 30 Study of Russian Air Force traffics, by 

Ltn, E. WOE LINER. 


Synoptic of original and present report numbers: 
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REPORT No. 1 


ORGANISATION OP KONA. 1. 

(No Gorman title given), 
by 

Major Urns i: HERTZ UR . (0. C.KONA 1 ) 


A. ORGAN IS AT ION . 

The Sigint. Regiment (KONA 3 ) controlled the following 
farces : - 

NAFAK. 617 
622 

Paste 10 
NANAK. 954 
NAAS . 1 

626 was subordinate, to Staff, S' gin-. Abteilung 
3 and FANAK, 617 and NANAK. 954 to Staff, Sigint. Abteilung 4 
NAAS, and Fes to 10 wore directly subord inato to the Regiment 

C ,0. 


Up to September 1944 NANAK 953 was also subordinate to 
Abteilung 3 , but it had then to bo given up to the West. Only 
the interpret err and c ry At Analysts' 'for Russian r e ma ine d behind. 
They were tt nucleus of close range sigint forces in tho Army 
area served oy Abtoilung 5. Specialists of various kinds 
were withdrawn from each company and attached to Abteilung 3, 
so that finally a complete close range sigint company was again 
available to Abteilung 3. This company was named after the 
C.O., Oberleutnant BENOI23. 

About tho same time it became necessary to establish a 
close range sigint service in the area of Pz . AOK. 1, (A0K.17 
had beon pushed up via LEU BERG to tho BARANOV/ bridgehead after 
the Russian offensive; the (Sigint.) forces previously operating 
in sector of Pz , AOK, 1 were now operating in the sector of 
AOK 17, the more important sector.) Again the necessary forces 
were vTithdrawn from the other units; the Close Range Sigint 
Company of Oberlcutnant PREUSZ was formed. This company was 
lirectly subordinate to the Regiment 0.0. 

B . DEPLOYMENT , 


LO NG RANGE S IG INT . 

Regiment Staff and NAAS, always operated in the immediate 
vicinity of the Army Group H.Q, The original plan for the 
employment of Long Range Sigint Companies was that one should 
operate with ea ch army staff , at about army level, and" cover an 
army sector, When German withdrawals began, however, this 
proved impractical; the pressure of work was usually greatest 
at the very time when the companies had to withdraw. 

Consequently in the last year, 617, 623 and Feste 10 operated 
further end further to the rear, in the immediate vicinity of the 
Staff and one NAAS, i.e. in the vicinity of the Army Group, This 
ensured more rigid control of interception and evaluation and 
quicker passing of results. 


DECLASSIFIED 
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CLOSE .RANGE SIGINT . 

Tho CIoro Range Sigint. Compn.YLy o]«ayfi operated by 
platoons, one platoon with each Corps Staff, Each platoon, 
covered ft own Corps sector. The platoon had a strength 
of 20 to 30 men, about 12 interpreter operators for taking 
r/T traffic, 2-3 W/T intercept operators for morse, 3 
evaluators, 1 Close Range Field D/F section with about 5 men, 
clerks, drivers, a cook etc. 

The platoons reported their results to the Corps Staff 
and to the Evaluation Section of their Company which was 
located at Army. The Company Evaluation Section correlated 
all results from all platoons and reported the combined results 
(laterally) to Army Staff and back to tho NAAS* 


C . D /F. 

Wo distinguish between Long-Range and Close-Range Field 
D/F sots. Long Range D/F sets were employed 200-350 km, 
behind the front line. 2 to 3 D/F sots in one place 
constituted a B/F Group; each set would operate for a 
particular company. Results were reported back by 7if/T. The 
most favourable points of intersection and the peculiarity 
of tho terrain were factors taken into account in choosing 
s ites . 


The Close Range Field B/F sets were located with the 
Close Range Sigint. platoons, They served the platoons but 
also accepted 'Request s' of the Long Range Sigint. Companies. 
(Which D/F sets received 'Requests 1 from which Company was 
arranged in accordance with the situation. ) Reports back to 
the : Range Sigint companies were made by W/T. 


D. 


C 0 MM UN IC AT 10 NS . 


In general, the landline not of the Army Group was used; 
all results could therefore be passed by T/P or telephone. The 
Army Group telephone construction units made the tappings and 
undertook major structural modifications, We installed internal 
lines ourselves. So that work should continue oven when linos 
rare Sown, ©very unit, who the i.bt 13 g, company, Platoon, ox 
independent section was equipped with W/T. As soon as a line 
was down, W/T came into operation. In this case only abridged 
reports were tran smitted • 


REPORT No, 2 



ORGA NISATI ON OF FECTE 10 . 

Localisation cTor Fesfceii TIachr , Aufkl. Stella in' f 
toy 

Ob Itn . )! i lhe lm KNAUS (Pest e 10 ) . 

COMPOS IT ION . 

1 , Commanding orfj.c er 's Grou p a nd baggage train , 

l Officer, £0 NCOS and men, 4 Tamale Sigs„ assistants 
and 2 female Staff assistants, 

2 o Intercept platoon , 

30 NCOs and men, 54 female Sigs, assistants, 

3, E'v - Vaatlon , 

£5 NCOS and men, 8 female Staff assistants, 

4 , C rypt -analysis . 

1 -’fleer, 15 NCOS and men, 

5 , Sig s, Platoon . 

a) W/T Section, 4 ft/T Operators, 3 femalo Sigs, 
assist ants „ 

b } T/P : 3 Operators, 
c) 'Phone: 3 Operators 

6, D /F Platoon . 

50 NCOs and men. 

TASK. 

1. Commanding Officer's Group and baggage train: 

Supply of Sigs, equipment and vehicles, rations, clothing, 
kit; also welfare questions, 

2, Intercept Platoon. , 

Cover of: 

a) unknown traffics in 3500 - 5500 kcs. band, 

to) fixed NKWD nets specified toy NAAS, 

c) nets of mobile formations as required toy NAAS. 

(some of these nets partly covered also toy NAFAK 
617 or 623. ) 
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3. 


EVALUATION: 

a) elucidation, Interpretation and reporting of 
new traffics appearing on frequencies above 
3500 kes, Control of cover. 



b) exploitation and sorting of intercepted signals. 
Preparation of ’Advanced Reports' j 'Technical 
VJ/T Sitreps 1 j '5-figure offers' and 'Report on 
Intercepts,' 0 


4 - CRYPT -aNAIYSIS : 

a) translation of P/L signals. 

b) solution of new systems and reciphers. 

c) contribution to Interpretation of ur. known 
traffics by identification of old keys, 

5 • CIOS, PLATOON . 

Responsible for : 

a) W/T communication with Rgt . and the d/F sites, 

b} passing of all results (T/p or telegram) to 
NAAS • 

c) passing of D/F requests, 

6. P/F PLATOON . 

Task: to carry out the 'd/F requests' of the 
Companies, 

(The D/P Platoon is not carried on Establishment. 
It was only possible to set it up with allocated 
female Sigs, assistants who are carried over and 
above Establishment . ) Tae platoon comprises : 


2 

TELEF UNKEN sets. 

1 

NCO , 

5 

men 

2 

RIGA / sets, 

1 


6 

if 

1 

LORENZ (converted) 

1 


5 

w 

2 

LORENZ 

1 

n 

6 

rr 


Plus: 4 M/T drivers. 


0 Interrogator's Note: 'Advanced Reports' etc. are titles of 
specific types of reports. 'Advanced Reports' usually give 
the text of a single Intercept, with comments, or one piece 
of intelligence derived from traffic analysis. The 'Report 
on intercepts' is a daily write-up of the day's 'Advanced 
Reports' plus the residue of intercepts which had not merited 
formulation as an 'Advanced report', 

'5-figure offers' are described in greater detail elsewhere; 
They simply list the interpret able elements of the (generally 


5 


— REPORT Mo. 3 — 


ORGANISATION AMD METHOD OF EVALUATION IN THE COY. 

AND NAAS. 

’Gliedorung und Arbeitsweise dor Komp, und der Nachrichten- 
Aufklaerung-Auswerte-S telle (NAAS ) . 1 

"by 

Ltn, Heinz POGANSKI (NAFAK.623) 


A , EVALUATION IN A LO NG-RANGE SIGINT , COY. 

Consists of traffic evaluation, content evaluation (with 
card-indexes), D/F evaluation, crypt analysis , traffic 
analysis, work on unidentified traffics, N.Jt.VI.D., and 
fusion. 

The working data for these sections are the traffic 
picture and signal;.. 

Traffic Evaluation prepares network diagrams showing 
the Traffic re 1 at i on ship s ’ in the various networks. The net 
diagrams i- '■lude the evidence which has identified the VJ/T 
stations; 5-figure characteristics, names which have appeared 
and further significant characteristics which will enable the 
traffic to be re -identified. These net -diagrams are the 

basis of all evaluation processes. 

Conten t -evaluat Ion works on all readable messages, 
identifies places , names and covernames, solves coordinates and 
sees to the immediate forwarding of all important messages to 
the NAAS, 


The methods of work of the remaining sections of 
evaluation are laid down in further reports. 

The routing of messages within Coy. Evaluation depends 
on their type: 

a) P/L, 

b ) 2,3,4- figure , 

c) 5 figure, 

d) miscellaneous. 

All messages go in the first Instance to the person 
responsible for signals headings; he writes the identity of 
the cal I -sign against the call -sign, P/L signals then go to 

the translator, consent -evaluation and fusion. 2, 3, and 4 
figure messages go through the relevant cryptanalysis section 
and thence to the translator. Thence, same routing as for 
clear text messages, 

5-figure messages go from the person responsible for 
headings to the 5- figure index where interpretations are 
written against the 5-figure characteristics. The traffic 
evaluator then enters the 5 -figure characteristics onto the 
net -diagram of the traffic In question, 

Sigint results are reported to MAAS, as follows : 
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B. the ORGANISATION OF EVALUATION IN a NAAS, is as follows : 

1) Technical and tactical evaluation of identified 
traffics [Army traffics picked up by Tong Range 
units } 

2) Processing of unidentified traffics (Traffics 
pTck"ed _ up oy Long Range units and Short Range units - 
the former may contain some which are not Army 
Traffics ) , 

3) Checking and tactical evaluation of reports from 
Short Range units . 

4) Traffic analysis, D/F evaluation, keeping of card- 
indexes, N.K.W.D, evaluation, Evaluation of Russian 
Air Force traffics. 

Cryptanalysis in the NAAS, is not, as in the Companies, 
a section of evaluation, hut is an independent section. The 
NAAS, so organises its work that it may check and carry 
forward the evaluation work of the Coys., and achieve a 
synthesis of the various branches of Evaluation end combine 
the results of Close and Long-Ran'ge Sigintj also of N.K.W.D. 
and Russian Air Forco cover. There is more detail on the 
various branches of evaluation in other reports. 
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ORGANISATION OF AN INTERCEPT STATION. 
’Die Organisation einer- Empfangsstelle, ' 

"by 

Uffz. Emil HERBS T. (NAFAK 623), 



1. TASK ; 

Cover of Russian W/T traffic according to Fronts (1st 
White Russian, 1st, 2nd, 3rd, 4th Ukrainian Fronts) within 
the frequencies 1400 - 7000 kes, 

2. DEPLOYMENT (WITHIN A COY.) 

Approx, 80 W/T operators were available. Of these, 

approx. 50 in 2 reliefs, each relief consisting of 15, 
employed during the day from 0500 to 1700 hours on search 
intercept, and approx, 50 operators in 3 reliefs (6 hours 
each), each relief consisting of 17 operators, employed 
continuously to observe known W/T nets, 1 or 2 receivers 
per operator, 

a) S e ar ch int ercep t . Allocation of a frequency band 
C/ "€o 150 kes , per receiver (depending on the 
density of traffic). Recording of all W/T traffic 
of the Russian Armed Forces including NKWD in the 
day report, (See day report pro forma), Recognition 
Characteristics: Q Z -, and specifically Russian 

procedure signals, methods of tuning of wireless 
station, method of conducting traffic. 


When day report had been submitted by evaluation 
sect ion 

1) discarding of traffic of no interest (air forco, 
traffic outside sphere of as signmont ) , 

2) intensified observation of traffic passing large 
volume of messages clearly tactical or strategic . 


3) Allocation of traffics belonging to sphere of 
assignment to receivers for further cover. 


b) R ece iv ers on cover . Continuous cover of recognised 
traffic s , according to the degree of importance. 

3. D/F SERVICE , 

In order to locate transmitters, long contact traffic and 
signals in known nets were D/F’d, as necessary; also signals 
in unknown traffic. Control of the D/F stations was exercised 
by the D/F Request transmitter, which was worked from the 
intercept station. This was wireless control: we had our 

own procedure signals to describe tho traffics which were to 
be D/F'd. Every ' Recyios t ’ had a serial number which was 
entered in the ’Day Report 1 , and, in the case of signals taken 
down, also entered on the intercept pro-forma. 
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(WITT ) 


(PLACE, DATE) 


Day Report No, 
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-- REPORT No. 5 


ORGANISATION AND TASKS OF CRYPT- ANALYTIC (SECTION ) 

OF NAAS. 1. 

' Auf gabe und Organisation dor Entzifferung dor NAAS 1 1 

by 

Oberwm. Klaus EICKHOFF 
(NAAS .1} 


The crypt -analytic (section) of NAAS . 1 bad tbo 
following tasks : 

1) to collect end work on signals which the Companies could 
not deal with, (whether because of lack of material or 

p ro o c r, uoa t ion w 1 th more imp ert ant s ys t ems ) . 

2) to tost and check doubtful solutions offered by the 

Companies » 

3) to establish v'b.o -her keys broken by the Companies wore 
the first :u] s of their kind; to complete them and 
put them into a handy workable form (the so-called 
'basic form 1 ). 

4) to pass on ''all solved key systems to Companies who might 

be in: . r ested . 

5) to assign a number to each key appearing in the Regiment’s 
area . 

6 ) w ork on N. K . W ,D , s ignal s . 

Crypt '-analysis in NAA3.1 wa3, accordingly, subdivided 
into the following sections ®: 

1) 2 -figure 

2) 3-figaro 

3) 4-figuro 

4 ) New developments 

5 ) Analysis 

6) N.K.vY.D. 

7) Bookbuilding (Code-Ausbau) 

3) ?/l text scrutiny 

9) organisation, 

Tho se ctions 1 to 3 looked through the relevant material 
in both raw aacT processed state: corrected or made up mistakes 
or inadequacies in Companies' solutions. (Signals on which no 
work had been done (at Company loval) were, if there was 
sufficient material, passed to tho section dealing with 'Now 
developments'. ) They were also responsible for checking the 
solutions offered in their respective (2,3 and 4 -figure) fields. 




S Translator's Note: Tho text has clearly WEITERBIIDtTG , 
which is almost cortalnly scribal error for WEITERLEITUNGj 
as translated abovo. 
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Section Now Dove lo omen 1 ; a did the real crypt -analysis . 
It normal ly c oi ic orvF. rat od " bn c i' ft i c ult systems which Companies 
had neither time nor man-power to deal with adequately, if 
at all . 


Tho - section consisted, in the main, of 

mathematicians and its rork was of mathematical, systematic 
or analytic nature ; 

.>>. iddresses (2,3 and 4 -figure). 

*■ 5- figure Signals, letter systems ( transpos- 

ition, Stone il ) . 

it aim mat ion of Signals with practice traffic 
•■.n.racteristics . 

Hot'. ct ion of solved keys to a basic form. 

-or a time L -figure signals also were worked on in this 
section but this work was soon handed over to Gen. ch NA. 0 

Into.: opted N.K.W.D, signals were worked on in the 
N . K . W ,lj, sect ion o i the NAAS .if they were or i g ina ted in the 
Re glment » " are a . ' The remainder were sent by courier to 
LNA . p 

The n-y.t solved by the Companies were passed, as 
noces s ary t o t ho boo k -building secti on (Code -Aus b auabt c i lung ) , 
to oo c o np le l . : d . ■ : Vi"s soction . o rkod in close contact with 

the analytic section (task common to both; establishment of 
basic form of hoys), 

Tho section responsible for P /h text scrutin y 
investigated questionable translations, 'corruptions , and 
abbre v ic. f- io< is . 

T ho oi g a n is at i on section was in control of all 
administration ; allocation of (German) keys and responsible 
for reports 10 Gen. d, NA. 

Crypt ^sna.lycic sections in NAAS. 1 totalled, according 
to establishment, 60 men; this strength was never reached, 
despite increasing difficulties in Russian keys which called 
for more and more specialists and assistants. 

Attached, a survey of Signals intercepted and studied. 
Figures indicate monthly averages (and correspond to the true 
figures). ^ 


$ Note: See table of abbreviations j Gen, d. NA. is the 

successor title of LNA. Ps/W normally said 'LNA 1 
and then added "which is now known as General etc." 


($ Note: Prisoners had no documents. In the majority of 

the diagrams and tables the figures given are stated 
to be arbitrary. The 1 at tached y statistics are on 

page 4^ „ 
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ORGANISATION AKO TASK OF CRYPT-ANA LET XC SECTION 
OF A LONG-RANGE SIGINT. COY. 

'Organisation und Aufgabe der Entsifferung oinor 
F umauf k 1 a e rung s ko mp an i e ' 

■ Toy 

Ltn. Harry LOEFFLER 
(Feste 10). 

Coy. crypt- analysis is organisod in the following 
sections : 

# 

1) Clear text translation. 

2) 2 -figure section. 

3 ) 3 -figure section. 

4) 4-figure section. 

0) General section. 

Their duties are apparent from their eesignation. 

The clear text section was responsible for translating, 
as quickly as possible, incoming clear-text signals. 

Sections 2 to 4 had either to decode signals sent in 
known codes, or to recover new systems. 

The general section kept various card indexes and lists, 
statistics of signals, and had other administrative duties. 

An establishment of 15 to 20 personnel was adequate for 
Coy. crypt • analysis , depending on the type of task assigned. 

The strength of the various sections was modified to cope with 
develop; V on the Russian side; namely, the shifting of 
emphases from 2 -figure to 3 -figure and then later to 4 -figure. 
Special procedures, such as Signal Co des (3 -figure and 4-figure), 
Word Codes and Address Codes "(3 -figure ), were studied in the 
appropriate section by specially chosen crypt-analysts, for the 
most part also by the chief crypt -analyst . The average 
working time to recover a new code varied a good deal, and 
depended oh the difficulties of the procedure. The amount of 
material required depended on the security of the system. There 
were systems which were solved in a few minutes with relatively 
little material. There were others which required a consider- 
able volume of material and a number of weeks' effort before 
they could bo oven partially solved. 

It was the task of Coy, cryptoanalysis not only to 
solve systems, to recover reciphers, to decode already known 
procedures and/or to translate all this material, but also to 
contribute to the identification and interpretation of traffics 
on the basis of the keys employed. 

The latter task was of especial significance in so-called 
search intercept J.on, where all the traffic of a particular 
area (e.g. on one front) had to be singled out and the 
remainder dropped. Identification of traffics by koy played 
a role similar to that of identification by call sign usage, 
frequencies, proper names, covornames etc. 
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C Vy p t 'fliia 1 ysl n o < lO j>o r-f h « U c 1 n cr> ly ■« 1-th li v <s 1 wpl+\ i rvrt find 
Int, ore r! pt i on* 

y.^c.: ’ ;rod and translated messages vie re forwarded to 
the fonit-T (.Evaluation) with notes calling attention to the 
key v i.:y'd or to other characteristics which would 
facilitate or confirm an identification. Collaboration 
bet .'.on Crypt -analysis and Interception was focussed on : 

Special observation of traffics carrying new code 
sjv stems. This might, in the case of important traffics, 
load to better int ere opt -operators being set to cover 
uch traffics. 


p'b r ' j/ u 
1 it 

of it 
the 
V j'.'k o 
ail 

traini 
of the 
train: 
b ranc n 


J, ■: 

,;r. 

L. _ 


nr 

os 


y. Crypt -analysis was, strictly speaking, from the 
view of Establishment, part of the Evaluation Platoon. 

practice, independent, owing to the special nature 
srk. It cooperated closely with Crypt-analysis of 
but was so organised and equipped that it could 
messages itself. For the training of crypt - 
there were short courses of instruction in the 
unit. Once trainees had a rudimentary knowledge 
u’c,;’ect they were drafted to field units for further 
and practical experience: in certain specialised 
this field training lasted a considerable time. 
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GENERAL METH OD; Examples of Evaluation. 
-- REPORT No 7 -- 


E V A-L U A T ION . 
'Auswertung' 
by 

Hptm. Roman ROESSLER. 
(NAAS 1) 


Evaluation of enemy w/T traffic (int ore o pood by 
Long Range and Close Range Sigint Companies) was carried 
out e cording to certain fundamental principles, some of 
V : were evolved in the course of operations; others 
hunches of individual workers. There were no 
;-ribed rules for evaluation, and this fact, determined 
1 J no material dealt with, made the success or failure 
■j't M.gint Service a personal matter depending on the 

... acity ana cr.perien.wO of a few °necialist : end 
:.- c operating in key positions. & 

:■ fundamental principle, established after much 
nec of opinion, was that the smallest detail serving 
■ r ceteris a or identify enemy jV/T traffic should bo 
u r v- e ; the resultant card index served the most varied 

р . •AV'" os, The mass of material intercepted compelled 
tb step; firstly as an aide mdmoiro, secondly a most 
careful record of all characteristics became increasingly 
u: ■■ .. -vj, with increasing Russian W/r security, the 
sources available for interpretation became continually 
loss numerous. Towards the end of the war, therefore, 
the card indexes were considerably extended, despite 
occ.au mi os in personnel and material. 

Assessing the efficiency of the various aids to 
e-": 1 cation, we give first place to the card index; It 
gave direction and continuity to our whole work, This is 
true in spite of single instances where puro crypt -analysis 
gave a right answer, e.g. identified an army by means of 

с. decoded signal. 

A fundamental principle of evaluation was to take 
account of everything (regardless of the importance of 
cne phenomenon o r the irrelevance of all other similar 

phenomena. ) 

Thus the card Indexes formed the indispensable 
material basis for evaluation, memory, experience, and 
perspicacity of the individual evaluators lent the spark. 

In accordance with the above principles Companies had 
to provide most detailed reports. A smoothly functioning 
report system was the chief problem discussed at almost all 
meetings to consider organisation. A Long Range Sigint 
Company needed an average of 16 typist hours to get out its 
daily report for the NAAS. 
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T Vie £>o;r*t 1.& pr p y n x r>d V h ^ 1 i.n jy fields 

(whether In writing, by courier, or by T/P and/.*: t^r^ahe*^ li 

1) Report on traffic of the tf/ T nets (call-signs, 
frequency, traffic workings, keys used, further 
characterist ics ) . 

R) Report on content of signals. 

3) Technical Signals Reports. 

The reports of all the Companies, collated by the 
NAAS . , gave a complete picture of the traffic intercepted 
during the day. The more important conclusions -- those 
wY-nb had tactical value -- deduced from traffic relations 
etri' ; content of messages , were collected in the daily g itustion 
( Lagemeldung ) . 

The work of the NAAS, was hardly reflected in these 
c . iltropsn (A small group of workers would have been 
' "i .... out for current observation and interpretation of 
y'l net3,) Since the intercept operator hears a 
r ■. • teal more than just the enemy traffic he has been 
. ’ • •. ,u to, and since by far the greater $age of all 

i.;r ..reepted traffic is unidentified, the NAAS. - as also 
1 ; . ■ TO - had to deal necessarily with all the traffic 
of : Russian Armed Forces. The interprctatic o f unknown 
t :a:. :T ’ ■ e was. consequently, from a long term intelligence 
pbl.Y cf view, the chief evaluation problem, and all the 
elements of the organisation, particularly the card indexes, 
had to be brought to bear on it. 

Comprehensive Research work which served to generalise 
aro/or systematise the detailed evidence was carried on from 
the same point of view, 

;Yr::her material which served in identification included: 

Names (including those heard in radio broadcasts) 

Cover-names , 

5 -figure characteristics. 

D/F results. 

(Map) Coordinates. 

Key usage. 

Contents of decoded signals. 

Technical characteristics. 

The part played by decoded messages in the total 
success of Sigint, diminished steadily towards the end of the 
war. Intelligence of greatest tactical value was drawn 
mostly from other sources (5 -figure characteristics, 
coordinates ) . 

What is said of the individual branches of evaluation 
in the following passages can only give a rough and approximate 
picture. The technique of evaluation in individual" instances 
cannot be systematised. 

By and large, Sigint. gave an almost complete picture 
of the grouping of Russian forces, from the fronts (Army 
Hr-oU'.'S ) via the Armies, down to the finnoo 
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The strategic mobile formations (Armour and Cavalry) 
were continuously covered. When formations could not be 
completely identified (because increasing camouflage measures 
denied us formerly accessible sources of information) the 
ove -all grouping and number of available formations was still 
cl ur, Rifle Corps and divisions were usually better known 
to ■, o XC through other sources (prisoners etc.) In the 
o venal t picture , Infantry formations were not as interesting 
as v.. - Senior HQ,s , and the mobile formations. It was 
essential for the IC that Sigint should observe events on 
the enemy's side which could be learned from no other angle: 
m. 1 '’* cents of strategic reserves, building of Schworpunkts , 
chain of command, intentions to attack (all seen in broad 
stuncegic perspective). With unimportant exceptions, 
thi. - task was fully accomplished by Sigint, 
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CARD INDEX SECTION. 

' Abteilung Kart cion' 
by 

Insp. Georg EERGER (NAAS.l) 


There was a special section in RAaS. 1 whose duty it 
was to look after all card indexes* 

NAAS . 1 was the chief evaluation centre within the 
Regiment: its card Indexes had to be as comprehensive as 

possFous. This meant collaboration with other Regiments 
empTO;, ' a on the East Front (2, 3 and 8) and with G.d.N.A., 
Each. An exchange system (new interpretations, corrections 
etc.) functioned smoothly by telegraph or courier (depending 
on utu ,;noy } ■ 

) Personality index, 

index. 

, j Bloc knot ‘inuu x\ 

< ) Key (SCHLUESSEL) index . 

5 ) Call-sign index. 

0) Cover-name index. 

7) Coordinates index. 


1) This card index contained the narr.es of all officers and 
Yj operators gleaned from wireless or from IC reports 

( , . .! int e rr ogat i ons , c apt ured data, etc,). Example : 
AIE3MSKIJ, OBERST. Chief Signals Officer, 1st Ukrainian 
Front. (Mentioned on wireless on 15/l/'45) or GWANOW, 
Major. Ai’ea 6th ?z , Army (18/2/' 45, KONA 8). Names from 
. wireless had to be treated with special caution, since 
the Russians used cover names for proper names. JJhen 
such were clarified, a suitable entry was made on the card, 

2) This card index contained all units of the Red Army from 
wireless or from IC . Each card had spaces for the 
following entries ; 

a ) Unit 

jv \ r } r\ * 

c) Chief of Staff 

d) Subordinate to ... 

... ) Sub* units j 

■ ) Operational locality or area, 
g ; Date of first appearance, 
h ) Sources. 

3) The Bloc knot card index consisted of : 

c ) Search card index, and 
b; Unit card index. 

Thu Search card index contained all known and unknown 
B I oc loio t s an d C hi -nur.tb c rs (which had bodn p ic ked, up ; 


The Unit card index, on the other hand, contained only 
known Blocks and Chinumb.oi’S , arranged according to unit. 



jii 5 -figure messages the bloc knot is one of the 
fiU-di 10 Groups. Its position changed at long intervals, 
but lias always easy to re- identify. 

The Russians differentiate between three types of 
blocks : 

1) The 3 -block, 'DRIERBLOCK 1 (also called 1 1 -BLOCK 1 

= Individual block, ) could be used, and read, only 
between 2 tf/T stations in one net. 

2) The 6-block, ' SECHSERBLOCK* (also called 'Z -BLOCK* 
s Circular block,) could be used, and road, between 
all W/T stations In a net. 

3) The 2-block, 'ZffEIEHBLOCK* (also called 'OS-BLOCK',} 
used only In traffic from lower to higher 
formation . 

The Chinumlier is the serial numbering of all 5 -figure 
me r:". m massing through the hands of the Cipher Officer, 
st ing on the first of January and ending on thirty-first 
L c'. ’'or of the current year. It always appears as the 
Isrt ,:r cup in a message, e.g. 00001 on the 1 January or when 
the : i e f. , newly set up , The pr o gr e s s Ion of C hi numbers, 
was ..a re fully observed and recorded In the form of a graph. 

A Kvcsian Corps had about 10 5-figuro messages per day, an 
Army ' - 3 1 ' . a front about 60-100. After only a 

rolativ ly short time the individual curves separated sharply, 
and the t ype of formation could be recognized by the height 
c.f Cb n urn /or alone, 

distribution of Bloc knots. Blocknots are distributed 
coni-:;'' J.lyTrom an o if ice in MOSCOW. Evory Bloc knot contains 
5-f groups in a number of sheets, for the enciphering of 
S-figurc signals. It bears a number of 5 digits on the front. 
Bloc - oss are. distributed as required in packages to the staffs. 

Trample: The 3rd Gd. Tk. Army transmits a 5-figure message 
with the Blocknot 1 37581* (one of the first 
10 groups In the message). On the same day 
the Block *37582’ was used by the sane 
formation. The next day *37583’ appeared. 
Thereafter the Army was no longer heard. It 
was maintaining wireless silence. After a 
few days an unidentified net with the Blocknot 
* 37588* is picked up. This net is claimed, 
because of the proximity of the blocks (88/83), 
to be 3rd Gd,T l o, Army, (The missing Block- 
nots 84-87 were presumably used in telegraphic 
telephonic or courier communications). The 
Cninumber (progression of the curve), provides 
confirmation of the first assumption (based 
on proximity of Blocknots) in most cases. 

4) The Key card index contained details of all solved 2,3 

Iguro procedures who t ho r thoir provenance (area) 
was known or not. Every solved key received a number 
from Crypt" analysis , which thenceforward was the name of 
•ho procedure. 2 and 3 -figure procedures in particular 
vers peculiar to definite formations, so that on the 
basis of key alone, conclusions as to the formation could 
be drawn without risk. 

5) Tho Call-sifai card index containeri oil — -■> 
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o } t.' ■ v > vot-. .rr* 10 card incU-k cent \i.nod all o overnames which 

ha I boon col i .or.od # niid Indicated, Bomvd, and date of 
occurrence. ./ ith the assistance of the card Index, 
vr, recovered, In many cases, almost complete covomame 
'.■•ilea for the Russian Fronts. 

7) Vh.i Coordinated card index contained all solved 

eye terns of (map) coordinates of the Russian fronts. 

!,t was organised in two parts ; 

.. ■ Coordinates arranged by systems 

' 6 ) Coordinates arranged according to units. 


I-'':; -.vm air traffic was studied in a special section 


The system of card indexes above described applies 
a 1 l. o t o the pro c o s s ing of air traffic. 
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o -? trnmecv: ON AN UNIDENTIFIED RUSSIAN TRAFFIC 
"jv 'ini’ SECTIONS OF EVALUATION 

1 Art-oitsweise bezw. Zusammenwirken dor Abteilungen 
.-} p p aus w e rt ung bei dor Erf as s ung sines unb e kannt en 
ru s s i. s cb.cn V o rkehr s 1 II) * IV) 

by 

Ltn. Hans BOSKAMP (Feste 10). 


I) All W/T traffic recognised by its manner of working 

a.; Russian was handled in the traffic evaluation section 
- r.a worked up into ne tw o rk di a gr ams ■ The network 

■Via gram c out a ine d : 

I . Net number 

f\ ; JU'JO 

V 1 T ra f t i a w o rk in g s wish call-si gnc . 

V Number and kind of messages, if any, sent, 
o } L/F number, 

0 : BLOCK and CHI -number of any 5-figure messages 
Intercepted; 

" ; S ho rt p / L texts, if any ( inc lud in g name s ) . 

II) f:tudy of the network diagram in the 5 -fi gure section 
tin case a I -figure message having been picked up ) * 

:nt I f ic at ion of the W/T station sending the 
5' -figure message. (3 LOO KNOT used perhaps already 
indexed as known in the 5-figure card index). 

! Suggestion fo r ide n tification ; a BLOCK NOT with 
almost the same number in the index, 

■'i ) Identification by GHI-number alone (or in 

conjunction with the B LOG KNOT ) checked against the 
GHI-number graph. 

4) Identification of general class (e,g. Army traffic) 
by other 5 -figure characteristics, 

"IX: Ovacy of network diagrams In TA section, 

1) General scrutiny of composition of call signs, 

Si Determination of area covered by net (Front, Army etc.): 
comparison of call signs used wish ’Basic Book for 
Allotment of Call-Signs' (Hauptvert eiler ) . 

*) Recording and collecting of call signs still 

unc la r if led (in order to recover new call sign 

systems } , 

IV) necking of the netv;ork diagrams and messages against 

•:\o card indexes of names, covennames, and cover- numbers . 

1- one If Icat ion of names and numbers by means of the 
index; hints for interpretation already entered on 
the network diagram taken into account. 


fiai 
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V) 


Study of tho not work d .1 .qpjvams in the D/F Evaluation 

Section • 



1) Does the D/F fix, if any, point to an area near 
the front? If so, probably army traffic ( ’’Front 1 
or ’Army’ Area). 

, I 

2) Does the D/F fix point to the rear area? If so, 
probably Air Force or L. of C, services. 

VI) Final evaluation (Fusion). 

1) Decision on the Identity of the traffic, taking 
into consideration : 

* 

'i the balance of the results entered on the 
network diagrams by the various sections. 

L ) results obtained by Crypt-analysis section. 


i\ ) j dent if iod t ra f f i c s . 

b) tactical information derived from the 
messages. 

3) Guidance for interception. 

a) Cover of less interesting traffic suspended. 

\j ) Special attention to more interesting traffic 

ordered e 
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3IGTNT . SIT RE? , 

0900/27/4 - 0900/28/4. 

'Nachrichtonaufklaerungslagemeldung, 
0 900/2 7./4 - 0900/2874. ’ 

by 

Ltn, Oskar SCHWARZ 
(NAFAK 617) 


FI RST U KRAINIAN FRONT . 

In cooperation with formations of the First White 
Russian Front, 1st Ukr. Front 0 fCompleted the envelopment of 
Berlin in the area North-east/Brandcnburg. 

We must reckon with the insertion of a major formation 
(independent mobile corps or an army), not previously known 
in this Front, possibly in the area of LIEGINTZ . 

1) Confirmed in the area of the Front : 


4, 

Tk. Army 

13. 

Army 

3, 

Gds. Tk. Army 

3. 

Gds. Army 

59. 

Army 

28. 

Army 

6 . 

Army 

VII 

Gds. Mech, Corps 

21. 

Army 

I 

Polish Tk. Corps 

52. 

Army 

I 

Gds. Cav. Corps 

2. 

Polish Army 

IV 

Gds. Tk. Corps 

5. 

iji- r i 

G<5. Army 

k Armies , 

XXV 

Tk, Corps 


4. Tank Army. Joined up in area NE. of Brandenburg 
with formations of 1st Ukr. Front attacking from the 
North, and has thus completed the encirclement of 
Berlin. Army cooperating with 3 Gds. Tank Army and 
elements of 13. Army, 

V Gds. Mech . C orps. Regrouping out of area Spremberg 
Tnto area NvTT of LUECKSNWALDE. Main body of Corps 
attacking Brandenburg. 

For battle reports of subordinate brigades, see 
Advance Reports. 

V I Gds. ^o ch. Corps . Thrusting via Ketzin into area 

S'. bf'NAWSN/h'as joined formations of 1st White Russian 
Front . 

X Gds. Tk, Corps . Unchanged, committed with all 
brigades in the area of TELTCW . Corps cooperating 
with elements of VI Gds, Mech, Corps. 

For locations of subordinate brigades, see 
Advance Reports. 

93. Independ e nt Tk. Bde. Allotted (temporarily?) to 
VI Gds . Mech, Corps, 
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3, Gds. Tk. Army. Unchanged; all formations fighting 
around Berlin. Schwerpunkt of the Army: E. of TELTOW. 

V I Gds. Tk . Corps and VII Gds. Tk. Corps still in the 
same area (E. "TEETCT) . 

IX Mech. Corps supported by 91. Independent Tk. Bdo. 
in “are a 30 5 S EfT- KQ EN IG S W UST ERH A US E H . Elements of 

Corps involved In mopping -up in area of 3ARUTH. 

Army HQ. in UENSDORF . 

Army Battle HQ In GROSSBEEREN. 

For battle reports of subordinate Corps and 
Bdes. see Advance Reports. 

3 ) Independent Mobile Corps . 

VII Gds. Mech. Corps. Still supporting 52, Army in 
the fighting near BAUTZEN. Corps cooperating with 
I Polish Tk. Corps, Corps Staff: 10 kms , M . of 
BA /ZEN. 

I Polish Tk. Corps. tfest neighbour of VII Gds. Mech. 
Corps. Corps still with 2 Polish Army, Elements of 
Corps badly mauled. Corps Staff: 12 kms. NW. of 
BAUTZEN . 


1 Gds , Cav . Corps . (U/T ) link with 52. Army no 
longer hoard. Corps is presumably now employed on 
independent task, (Thrust via GROSS ENt F'-RIESA 
toward S ft SB, wheeling SE. toward DRESDEN ?). 

Corps Staff; 4 kms. W. of GROSSEN^JLI .A 
Corps HQ.: W. of The ELBE, 6 kms. SE. of RIESA. 

Subordinated Div: (7 Gds. Cav. Div. ?) attacking 
MEISSEN west of ELBE. 

IV Gds , Tk, Corps, Unchanged in sector of 5 Gds, 

Army, attacking', with elements, German formations still 
in area SPREE-FURTH. Withdrawal of further elements 
of the Corps which had thrust over the eastern edge 
toward the west, and employment, likewise in area 
SPREEFUETH, appears possible. 

Corps Staff: Area HOGESWERDA. 

Corps BHQ: Trans rer red from area LAUDA into 

area SW, of HOGESWERDA. 

XXV T k. Corps. Unchanged in sector of 3 Gds. Army. 
Elem-; ;ts of Corps continue fighting in area COTTBUS, 
Corps Staff presumably transferred from area of 
COTTBUS into area of LUEBSENAU. 

4 ) Rifle Armies , 

59 Army, Shifting of boundary with 21 Army toward 
north , presumably as far as area PRIEBORN possible. 
Confirmation required. 

Offensive intention in area S. NEISSE. 
Unidentified Rifle Div. on S. edge of NEISSE 
receives increased delivery of arm. 

Unidentified Arty, Commander (A/Tk. Arty, 
Regt.) newly appeared In area S, NEISSE. 


6 Army. Unchanged 

mmiku. 


Employed against Forties 3 


XH*' 


21 Army. HQ. presumably moved toward W. from area 
lC“ f:ms7 NW. of KAUTH. Otherwise no changes in 
Army area. 

52 Army. Command of operations in area BAUZEN 
(direction of thrust DRESDEN ?) by Army confirmed. 
Elements of 52 Army employed there (1-2 Mobile Corps). 

( VII Gds. Mech, Corps, 

( I Polish Tk, Corps, 

( Elements of 2 Polish Army (3-4 Rifle 
( Divs.) 

German counter attack In area NE. of BA TEEN gained 
only little ground despite high Russian losses. 

Front line 2200 etc: Places 

Subordinated Corps ouop ©rating closely with elements 
of VII Gcb. Mech, Corps in sector 4 kms . NE . - 3 kms , 

NW. of BAUZEN. 

Corps Staff 4 kms. N. of BAUZEN, 

254 Rifle Dlv . withdrawn from the front; badly mauled. 

Gds. Mortar Rgfc . 'LIMA': Subordinated Abt., previously 
allocated to'25T Rifle Dlv., will support, after with- 
drawal from Dlv., a new, as yet unidentified. Rifle 
Div. 

"•n. 

5 Guards Army . Unchanged, supported by IV Gds. Tk, 

Corps . Element s of Army cooperating with unidentified 
Bde. of the Corps have thru 3 t via RUHLAND toward 

the West. Further elements of the Army also fighting 
German formations in area Spreefurth. 

HQ. unchanged, In area SE. of Spremberg, continues to 
bring forward 3 subordinated Rifle Corps. 

13 Army, Supporting, with elements, attack of 4 Tk. 
Army, Army with presumably only one Corps In area 
S.E. of Brandenburg In the front is regrouping both 
remaining Corps from area FENSTZRWALDE - LUCKAU in 
WNvY . direction, possibly in area WITTENBERG - 
TREUENBRIETZEN. 

28 Army. The large formation brou^at up out of area 
LIEGINTZ via COTTBUS Into area S. of BERLIN (cf. SIgint. 
Sitrep 19/4), is 28 Army. Collaboration with 3 Gds, 

Tk, Army possible. 

5 Gds. Arm y. Supported by XXV Tk, Corps, unchanged. 

Army fighting with all formations committed against 
elements of German 9 Army, who are fighting their way 
back toward the west, 

Schwerpunkt of fighting MARK. BUCHHOLZ. 

HQ transferred from area 12 kms, S. of COTTBUS into 
vicinity of LUEBBEN. Subordinate formations still 
XXI, IXXVI, and CXX Rifle Corps. 
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INTRODUCTION OR A NEW FRONT AND ITS EFFECT 
ON N.K.rf.D., AIR, AND ARMY TRAFFICS . 

’Das E ins chi ebon einer neuon Front und die Ausv/irkungon 
auf den N . K , ii.D . - , LW - , und Heeresfunkverkehr' 

by 

Ltn, Eduard WOELLNER 
(NAAS . ) 


1 ) N, K. I. D. 

a) A new W/T station is heal’d in the net of the Fronts 
and the Central Authority in M^SKOW • According to 
the W/T station number, it must bo the station of the 
Chief of the N.K.W.D, with a Front Head -Quarter s . The 
grouping of the new Front is apparent from the W/T 
picture (lateral workings), tho location of the 

Head -quarters can be fixed by D/F. 

b) One or more nets appear. Call sign usage indicates 
a Chief of N.K.W.D, troops (attached to Front Head- 
quarters) with subordinate Regiments. By D/F, 
location of the Headquarters and approximate extent 

of the Front (D/F of the Regiments) can be established. 

By D/F, and interpretation of indicators, and CHI- 
numbers the affiliation of stations under (a) and (b) 
and of nets forward of the Regiments can be 
established . 

2 ) AIR F O RCE. 

a) Air Force nets appear; judging by the rise in 
CHI-numbers, an Air Army must be present. As previously 
unknown BLOCKS and new names appear, it must be a new 
Air Army, Since in general each Front has only one ■ 

Air Army (only exception; 1st White Russian Front), It 

is probable that a new Front has appeared. 

b) Message content and D/F of ground units and flying 
formations indicate a gap between two Air Armies 
which had previously been adjacent, 

3 ) A RMY. 

a) New Front HQ. nets appear and are identified by 
5-figure and call-sign usage. 

b) SIgint shows gaps between the old, previously 
adjacent , Fronts . 

c) Toe Armies on the wings of both formerly adjacent 
Fronts drop out of the HQ nets . 

d) The new Front is mentioned in supply traffic, address 
of a 5-figuro message, or in W/T of forward units. 

It Is unlikely that all the above pointers will in 

fact appear. But two of them would be suffidAnf. 
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REPORT Mo. 12 


EXAMPLE. 

APPEARANCE OP A MEW MAJOR FORMATION IN 
1st UKRAINIAN FRONT. 

'3oisplel: Auftreten eines neuen Gross verb and os lm 

Berelch der 1. ukr. Front. * 1 2 
by 

Lt, Oskar SCHWARZ (NAAS.) 


I, REPORT: 

a) ‘i.gint sitrep 9/4 ... another heretofore unidentified HQ,* 
\ A i my / Inde pendent Mobile Corps ?) picked up* 

b) Technical argument ; 

1) Unidentified HQ: besides the well established 

command channels of the Front (HQ. to the Armies 
and independent Mobile Corps;) a new channel from 
the Front has cropped up. Recognised by: 

Method of conducting traffic. 

Use of frequencies (Traffic Evaluation) 

Use of call-signs (T ,A . ) . 

2) (Army or Independent Mobile Corps ?} : 

Previous experience shows that characteristics 
noted in (1) occur only in command charnels 

to Armies and Independent Mobile Corps „ (Question 
mark shows we are uncertain which of the two 
solutions is correct), 

II. REPORT. 

a) Si gint Sitrep 10 / 4 , The HQ. reported in Sigint 
uTt.feip 9/4 is an lnd e pend en t Mobile Corps, possibly 

V Guards Mechanized Corps (previously in 4th Ukrainian 
Front area), 

b) Technical argument; 

1) Independent Mobile Corps: Height of CHI-number 
(5-figure evaluation), 

2) Possibly V Guards Mechanized Corps: height of 
CHI-number (5 -figure), name of Russian W/T 
operator (proper names), W/T channel from HQ, 

4th, Ukr, Front to V Guards Mechanized Corps 
has disappeared. (Traffic Evaluation). 


HI* REPORT . 

a) Sigint Sitrep ll/4, V Guards Mechanized Corps 
confirmed in 1st Ukr, Front Area. Possible that 
it is operating in 59th Army area. Tentative 
identification of 10 /4 confirmed. 
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b) Technical ar g\ merit : 

ft 

1) Height of CHI -number, proximity ■ >f BLOCK 
(5 -figure evaluation)* 

2 ) W /T operator 1 s name c onf i rme d ( p r ope r -nam e 
index. ) 

3) 3 -figure address. 

Possible that it is operating in 59th Army Area: 

1) Operational message (5-figure) of 59th Army 
via Front HQ* to V Guards Mechanized Corps. 
(Traffic Evaluation) , 

2) Uncertain U/F fix on Corps Staff in 59th 
Army Area. (B/F evaluation). 

IV. REPORT : 

a) Sigint Sitrep 13/4, Bringing up of V Guards 
Mechanized Corps into 59th Army Area, (1st Ukr. 
Front) confirmed. We expect it to operate on 
right wing of Army. 

b) Technical argument : 

1) nr-inging up confirmed: V Guards Mechanized 
Corps appears in Army command not of 59th 
Army. (Traffic Evaluation.) 

2) Operating on right wing; Corps staff moved 
forward out of roar Army area to the right 
wing of the Front t and is in forward area 
(D/F Evaluation). 


frJiJK<uv r i VJf I 


27 




M 

K 

L>0 

rJ 


> 


0 

1 
< 


» 


REPORT 


No. 



SHIFTING CF SCH.VERPUNKT ; THE NORTHERN WING 
OF A -FRONT INTENDS TO ATTACK. 
•'Schwerpunktv’erlagerung u. Ar.gr If fsabsichten am Nord- 
fluegel oiner Front * 1 2 3 4 5 , 
by 

Lt. Hoinz POGANSKI (NAFAK 623). 


The situation is: a Front, consisting of 1 Tank Army, 

2 mobile formations and 5 Infantry Armies has boon on the 
defensive for 4 weeks. Wireless traffic (strategic) is 
restricted to contact Traffic and chat. 

The following phenomena indicate a shifting of 
Schwerpunkt and intention to attack. 

1) A new W/t station appears in strategic v?ireless 
traffic on the northern wing of the Front (D/F) and begins 
to work with the Army on the Northern wing and the Front's 
Tank Army (hitherto located on the Front’s Southern wing). 

It could be either a Battle HQ. of the Front itself or a 
newly brought up formation (mobile or infantry?).. 

2) The Tank Army reports On 5/6 ’am moving'. 

3) An Echelon of the Front HQ. appears; according to 
uncertain D/F bearings it is moving north, 

i 

4) The mobile Corps of the Front (hitherto on Southern 
Wing) tries to contact the Infantry Army on the N. 
w ing . 

5) A Guards Mortar formation has, according to Close 
Range Sigint, received 4*5 consumption units of 
fuel. 
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SHIFTING OF THE BOUNDARY BETWEEN 1st AND 
2nd ARMY, SIMULTANEOUSLY THE CORPS ON 
THE RIGHT WING OF 1st ARMY PASSES TU 2nd 

ARMY. A 

1 Verlegung der Trennungs linie zwischen * 1 2 1 1 Armee 
und '2' Armee bei gleichzeitigem Unterstellungswechsel 
des x-echten Fluegelkorps der ’l 1 Armee unter 1 2 ' 

Armee . ' 

fey 

Lt. Klaus WEIHE (MAAS.) 


The following recognised fey means of : 

first Close Range Sigint. (Evaluation of signals 
content ) . 

second 1 Long Range Sirint (Traffic Evaluation and D/F). 


1) Move of boundary; simultaneously, formations of 

‘l 1 Army taken over by '2* Army, 

a) A signal shows GHQ, troops (Guards Mortar 
units) on the left wing of '2 1 Army are moving 
into the sector hitherto held by 1 1 1 Army, 

b) Reference in traffic of forward formations 
on the right wing of ' l 1 Army to the 'new 
high-ups' (neuer grosser vorgesetzter ) • 

2) Right wing Corps of 'l' Army passes to '2' Army. 

a) A new rf/T station in the Command net of '2' 
Army , 

b) W/T station, has characteristics of previous 
right -?/ing Corps of ’ 1 1 Army (5-figure 
characteristics , ChiHjiumher ) ) , 

c) W/T station is D/F'd in known location of 
previous right wing Corps of '1 ! Army . 


A "Translator's ^o be : Inverted commas indicate these 

numbers are arbitrary. 


in 4 ' 
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CONTRIBUTION (IN TEFliS OP A i-NRCENTAO ,) 
OP VARIOUS LEAN'S OP IDENTIFYING 
( N/T STATIONS) + 

"Anteil dor Dsutimgsq.uellen, " 

"by Hptm, Roman R0ES8L3R (O.C. NAAS.) 


5-figure interpretation, 

as sole source: 65 - 70% 

in conjunction with 4-figure: • 90% 


Decodes: 

5 - 10% 

P/L: 

1 - 2% 

0 over- names: 

15% 

Proper-names: 

5% 

Procedure signals 
and truflic picture: 

1% 

Gall-sign usage as sole 

source: 


8 % 


" in conjunction with 
recurring call-signs cl frequencies 


10 % 


+ Note: .o H $/T Stations ' 1 supplied by Interrogator/ 

Translator. The statistics apply strictly to this 
ono process. 
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Prom personalities & cover-name index 
"Namen " , 

"by (combined effort) 


i :/« 


JEREMENKO 

G. in 

G, 4th Ukrainian Front, 

MOSALENKO 

GOG. 

38th Army, 

KRA WT SCHENK 0 

h 

6th Gds, Tank Army. 

KATUKOW 

it 

1st Gds, Tank Army, 

POLJUBOJAR 

i.C, 

IV Gds, Tank Corps. 

KORTG'.’KAGIN 

i.Go 

VII Gds. Kech, Corps 

SCHRAGIN ) 



ALESKOWSKY ) 

) 

PJANOW ) 

Sigs. 

personnel with H»Q. 1st 


SCHACHRAJ 

ANISSIMOW 

SOKOLOV/ 

UIviFORi.lER 

G US JEW 

PUCHOV/ 

GORDON 

PII11 


Head of Cipher office of HQ. 1st Ukr. Front. 
Chief QM. ,f " 11 « 11 

C. of 3, " " lf " » 

Gover-nair.e of 59th Army. 

C. in C, 21st Army. 

" 13th Army# 

11 3rd Gds. Army 

Gover-name of 1st Ukr. Front, 


(From Unit card, index) 
(No German title) 
by; ? (combined effort) 


Notes; "F" means wireless psendonym. Ic means; information 
from German IG 


4 Tank Army 

4 Tank Army 

VI Gds. Me ch. Corps. V Gds, kech. Corps, X Gds. Tk. 

Q ox 1 ps « 

Cover-names 

4 


ROSOHTSOHA 



3AHLYK 

LIVER 

PYRAMID® 

0, inC, 



LEi^ Jf-OHSNKO 

WORNOW "F" DA./IDOW "P" 

GEOMOtf ”F" 

OGNEW-DONSKOJ 

’'F'* 

AKULOWj Ic , "P" 

BZYRIN "P" 

JAWORSKIJ, Ic , "F” 


OSTROWSKIJ, Io 

M TTiir 

0 J? • 



( eto) 

( etcetera) 

i.C. Brigades 



OZEROV/ "F" 



MORE jW "F" 



Ghi-Nutr.ber on 

1 /Jl-. 


about 1500 

about 6C0 about 650 

about 500 


* 

3rd Guards Tank Army. 


3 Gds, Tk. Army 

. VI Gds.Tk.Corps. VII Gds.Tk.Corps. IX Kech, 91 



Corps. Indep. 



Tk.Corr 

C. In C* 



RYBALKO, Col. 

Gen, 


LIWOHIZ, CSO, 

"F" etcetera 


BOUSOW, Col. , 

SO, 


( etc) 




Chi-Number on 1/5: 


TRAFFIC EVALUATION, IDENTIFICATION OF TRAFFICS 

"Verkehrsauswartung, Erkennen der Verkehre" , 
by Obergefr, Gerhard SGIiOLZ, 


I. Fron t HQ . (FOK) Command nets. 

Line traffic on two frequencies with periodically 
changing call-signs. 

Every formation directly subordinate to FOK (Army, Corps) 
has two lines. 

These can be identified by 

1) Frequencies ( unchanging frequencies, about 

2210, 2400 kcs. ) 

2) Signals transmitted 

(a) 5-figure characteristics (Bloc knot, 
Chi-number, cover-names, proper-names) 

(bj Cipher signals (key usage, addresses) 

(c) Contents of signals (P/L and decoded 

signals) 

3) Call-sign "usage fcall-signs taken from a 
definite table, (perhaps) every third line) 


FOK A OK 


abc 



def 

e — 2212 — =, o 

n ■ - < - « 



c 246o 


ghi 


■ 


I I . Army Command Nets , 

Army links with all subordinate formations comprise one 
or two nets; there is further a net for each 2 or 3 
formations. In all, about 6 to 8 nets. Frequencies in 
1800 - 4500 kcs. band, but mainly in 2600 to 3400 kcs, band. 
Each net may have about 3 frequencies (main or working 
frequency, alternative or spare frequency, calling frequency). 


Identification by: 

1) Working (star, Kreis & Nets) 

2) Signals transmitted (see under FOK Nets, 2a, 2b, 2c) 

3) Call-sign usage (see 

III. Corps Command Nets, 


3 ). 


Reidentification of a Major A r mo ’’rod Formation 
withdrawn from Front. 

"Wiedarerkennen eines aus Front herausgesogenen 
Punzergrossverbandes" 

by Inspr, Georg, BERGER (NAAS) 


When the Russian Spring offensive of 1944 stopped 
at the VISTULA * W/T silence descended on the operational nets 
in the area of 1st Ukrainian Front. A few lines of the 
Front HQ, were occasionally heard testing. Naturally, the 
main effort of Evaluation thenceforward lay in the study of 
unidentified traffic. 

Several nets stood out from the mass of unidentified 
traffic. Special characteristics in their manner of 
conducting traffic, the structure and transmission of their 
messages, led to the following interpretation: 

Net No.l . 

3050 kos . 1 / 9/1 944 


00 ) ^.-lba (01) with operators 

with operators ) (04) (05) (06) 

zvi (02) with operators 08 
, v (07) (09) 
rok (03) with operators (10) 
( 11 ) ( 12 ) 

The bracketed Nos. supplied; later confirmed. 
Transmission of messages: 

Time of intercept 


0690 /lbs/gne 

- No. 6,Gr. 

50; 

00001 

001 0£ 

06000 

1(3^78 

98765 

634SS 

56879 

32109 

etc. 

072o/lba/gne 

- No. 7* 6-r 

, 52; 

00001 

60109 

07100 

12345 

S 2 S 90 

etc* 

1530 /rok/gne 

- No. 10, 

6-r , 50 : 

00002 

001.09 

1 5100 

(groups 

as above, 

(series of figures) 

1 600 /gne/ zvi 

- No. 3, G** 

. 57: 

r 0 P 


1 5450 etc* 


First investigation of above messages revealed: 
1) First, group - indicator? as yet unexplained 



4) Regular sequences of figures point to practice 

messages* 

Further evidence of this; messages of about equal 
length, 5-figure indicators (BLCCKNOT , hey indicator, and 
GHI-number) usual in operational traffic, lacking, 

.After this much had. been established, the net was 
reported as particularly interesting to a Company and D/F 
task allotted, 

t 

On 2/9/44* picture was as follows: 

Net No. 1 

3050 kcs, 2/ 9/ 44 


gne- 


^ lb a 

4 — zvi 

~ — rok 03 with operator 10. 


Time of Intercept, 

0130/zvi/gna - No. 13* Or, 53: 

00001. 00209 00400 etc. 

• e i t i 

0410/zvi/gne - No. 14* Gr, 51: 

00001 00202, 03500 etc. 

0500/gne/rok - No.1* Or. 58: 

00310 00209 04350 etc. 

- " - ■*“ i c a i i 

0810/lba/gne - No. 17, Gr, 50: 


00002 


002C£ 


07500 etc, 

* i i ■ t 


D/F fixes gave points of intersection and triangles 
of error for all stations in the general area of LWOW. While 
the control station (recognised as such from the intercept 
picture ) could be located in LWOW, the fixes of the out- 
stations were different every day. It was assumed that the 
out-stations were mobile and changed their locations whilst 
engaged in a .</T exercise. This assumption was confirmed by 
P/L messages saying: "We are moving" or "We are closing down 
for a change of location", etc. Further a few operators names 
turned up in chat. 


Further investigation of the message beginnings 
confirmed the interpretation of the 2nd and 3 groups as date 
tactical time group respectively. 

The 1st group was interpreted as follcwsi- 

00001 = 

1st element = dummy, 

2nd and 3rd elements = number of W/T Station. 

4th and 5th elements =■ number of operator at 

keyboard* 

This signals exercise lasted from 1/ to 10/9/44, 

8 nets were picked up in the course of the exercise. Their 
stations, and operators, were numbered serially, As a result 


The contents of the P/L messages sent made it clear 
that the nets represented the set-up in the signals exercises 
of a major motorised formation, “~A further clue to this was 
the number of net’s (8). 

Somewhat later, about 15/ - 20/9/44, a not with 
operators’ names from the above mentioned practice traffic 
Vires picked up and D/F’d in the rear area of the 1st Ukrainian 
Front, .According to P/L and 3- and 4-figure messages of 
the Front i,i/T Authority, the formation was receiving 
continuous replacements of ammunition and fuel. Further, 
bringing up of stocks of tanks was announced, As observation 
proceed, it became apparent from proper-names and 5-figure 
indicators (BLOCK and CHI) , that the formation was the 3rd 
Guards Tank Army, 


The Study of unidentified, traffics 

"Bearbeitung unbekannter Verkehre" 

hy Uff z. Ruprecht STROHTMANN. (Fasts 10) 


Purpose ; To elucidate traffics intercepted on search, which, 
though recognised as Russian, were not yet identified.. 

To establish whether they were Army, Air, N«K, W. D, 
or Partisan traffics. Within our special field the main 
task was to discover new .Army traffics, or to re identify 
known traffics using changed signals data. 

B ean - i A whole Sigint Company (Feste 10) was available 
in the area of KONA 1 for the task of discovering elucidating 
unidentified traffics. 


Work on unidentified Russian traffics. Traffic 
Characteristics as a means to identification (Deut ungsquellen) . 

A : Means of rough ident if icat ion ( whe t her Army , Air , N . K. vU D« 
or" partisan 'traffic)^ 

0 Call- s ign usap^ (See Traffic Analysis) 

N.K.W.D; only means of establishing the Central 
N.K.W.D, authority is call- sign usage (W/T Station numbers). 

Army and Air: from call-sign usage it is possible, 
provided the call-signs are taken from the "Basic Book 
for Allotment of Call-signs* (Houptverteiler) ■, to say 
whether in all probability the user belongs to certain 
Fronts, or not. 

Aids to call- sign study: 

(a) The "Basic book for allotment of call-signs" 

(b) Call- sign card- index: contains all call- signs 
which have appeared, with a reference (by Network No.) 
to records of the traffic involved. This index helps 
in re-recognition of previously known traffics (say, 
in instances where call- signs work according to 
cycles) ; it serves also to build up new cell-sign 
squares or call-sign Blocks, 

2) Manner of working , procedure signals . 

Manner of working and procedure Signals used permit 
identification, with a certain degree of reliability, 
of Air, Army traffics etc. 

Pa r t isan W/T : can be identified with certainty; they 
use one call-sign only; most signals are transmitted 
blind; they use the international abbreviations of 
amateur wireless, e.g, GK for number of groups; Their 
5-figure signals have neither Block nor Chi-number* 

N.K.W.D ; The procedure group QGO together in the 
nreamble with NK indicates,, with high degree nf 


jilr : preference for qoo (instead of qtc) : wzd 
(air raid warning signals); met, signals. 

Army : Absence of the above characteristics. Latterly 
on the 1st Ukrainian Front, line traffic using 2 
frequencies end 3 call-signs for the line, 

3) Typ e s of Signal , Signals content, cryptographic 
characte’rist ics. 

Partisan : 5-figure signals only; No Block or 

Chi-No. 

N. K, >/,D : 4 sod 5-figure signals with indicators, 

also some isolated 3 and 2-figure signals (operators' 
technical chat) , 

Air ; More p/L than in Army traffics; 2 to 5-figure 
signals; met, signals with unmistakable 
characteristics (Groups with XXX) - Air Recce reports 
mainly in P/L, etc. 

Army : Practically no operational signals in P/L 
(Exception: reports on "enemy", including reports 
on reconnaissance of (against) "enemy"), 3 to 5- 
figure signals, k letter ( Stencil; ) + , 5 letter 
. (machine) + signals (of MOSCOW General Staff), 

3 and h-figure encoded signals often contained P/L 
groups. 

Interrogator's note: interpolation supplied verbally by p/V/. 

Means of final identification of a previously unidentified 
traffic: 

1) Contents of decodes (units ere practically never 
mentioned by name in P/L signals of Corps, Armies and 
higher formations). 

Card index of keys: identification by means of 
key used is possible as, generally, one code is used 
only by one unit, 

2) 5-figure signals: the most reliable and by far the 
most important means of identification. 

On Blooknots, their distribution. Chi-number, 

5-figure card index, Chi-number graphs, see 5-figure index, 

3) Further means of identification: Cover-names 
(including officers' psendonyms) in p/L signals, Proper- 
names in uncamouflaged form in encoded (rarer in p/L) 
signals. 

Details in paper on Card Indexes, 

D/F bearings are most important. Location of a W/T 
Station by d/f makes it possible to exclude immediately, say 
all L, of C, authorities and formations not conducting 
operational traffic. The location of a U/T station by D/F 
in conjunction with evidence of types discussed above 
inevitably permits clear identification. 
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D/F EVALUATION 


'i'Pe ilauswertung" , 
by Lt, Edward WO SLUTER (RAWS) . 


Russian wireless discipline and cipher security 
became better and better: D/F became consequently one of the 
most important branches of Sigintc Improvements in our 
equipment and improved (wireless) "Request" systems enabled 
us to fix a W/T station,, 

by long range D/F within 15 kms. 

" close " Field d/F" 2 to 3 kms. 

NAFAK 61 7 (covering 1st Ukrainian Front) sent its requests, 
for example, to 3 to 4 long range and about 12 clous r.ange 
D/F sites e The D/F units reported tack in enciphered wireless 
signals to Company 0 The reports were deciphered and given 
preliminary evaluation at Company - obvious lose v j were 
eliminated. All usable results were reported (bearing and 
class of bearing) to NAAS which gave its final Judgment on, 
and interpreted, tho bearing, 

A cord index, recording the various bearings on 
each W/T Station, helped NAi.S to Judge the value and 
significance of each bearing* 
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Re— 3. dent a float ion of Individual w/t stations 

"Bes W i e der e rkenne n von einzelncn 
Funkstellen 11 , 

ly Uffz Arno GRAUL (NAAST) 


Knowing how important it is to be able to 
re-identify individual W/T stations, I started about 3 
months ago to construct an apparatus which would permit 
re-identification of individual Iff/ T stations by their 
oh fir act crd'cti cs, ... 

f 


The method: to register the incoming telegraphic traffic 
in the form of an image on a cathode ray tube (BROVi/N'SGHE 
ROEHRE) and analyse the image. Analysis consists of a 
number of steps, so that all details and peculiarities of 
the transmitter are comprised. The apparatus is attached 
to a normal intercept set. The individual characteristics 
of the transmitter can be recorded graphically by means of 
tracings, or in the form of photostats? in a card index. 


Authority 
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(Network diagram of) 

Tank administration of 1st Ukrainian Front# 

“Panzerverwaltung 1 Ukr, Front 5 ' 

"by: ? 


3960 kcs; 4070 kcs; 3480 kcs (3230) 
call-sign periods 


? 


Tank R ^ w 

Control 



ICREU3BURG- 


LIEGNITS 


Names, 



LEWINSON 

liilLJ/iV/SKI 

uRLUWSKIJ 



outstat ions 


BORISOV ) 

a,m AW ) Motioned. 


declassified 

Authority 


Aids to- Cryptanaiys±dc 
"Bio Behelfstr.it tel dei* Entziff erung" 
by Gefr, libei-hard BAI 1 H (NAFAK 61 7) 


The aids to cryptarifdLyqia', , in the order in which 
they are used in breaking a message, are as follows; 

1 ) The call-sign index: a card index in which the 
call- signs were entered of processed messages together 
with the key used and the date of use. This card index 
was naturally only useful where there was no da ily 
change of call-sign; i,e, particularly the case of the 
BuSJian Air Force, 

2 ) Card index of keys. An index of keys arranged 
numerically (G-erman numbers) with date and area of use. 
Purpose, Identification of unknovm. traffic by known 
key, 

3 ) Card index of units. Formations arranged according 
to their numbers, together with the keys they had used, 

4 ) List of indicators and "shift groups", A numerically 
arranged list of the key indicators used in known keys - 
they were placed at the beginning and often at the end 

of messages - - and of the shift groups, ("reed letters," 
"read words" ) with information on key, 

5 ) Graphic and statistical presentations of letter 
frequencies , 

(a) Average frequency of Russian letters based on 
military texts of about 10,000 letters^ (Order: 
o , e , i, a, n , u , , , ) 


(b) Same for bigrams and trigrams {= 2 or 3 
successive letters, reckoned as so many to the 
thousand): e, g. 


A EM 

12,2 

0/00 

AEN 

10,8 

0/00 

A 3 R 

1 ,6 

0/00 

AER 

10,8 

0/00 

jiE 3 

0,4 

0/00 

AET 

18,1 

0/00 


6) Inter vals, A collection of wor.ds where a repetition 
of letters gives a characteristic picture. Example; 
EEMEDLENNO , "immediate" shows the following interval: 

NEMEDLENNO 
x o o o x x 
1 2 - 2 - - 2 1 1 


The collections contains 
f r e quant 1 y •> ec urrir: g phi* oees , 


not only words , but 
which can lead to a break. 


Or ..... 


1 2 2 12 

p 0 tsch S m u n E 0 t w E tsch a e sch 3 (= Why 
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7) Keys* The keys were entered on the following 
proformas and divided according to whether they were 2,3, 
or 4-figure: 


0 

1 

2 

3 

4 

5 

6 

7 

8 
9 


23456789 

0 

1 

2 

3 

4 

5 

6 

7 

8 

9 

23456789 


Following also noted on pro-forma: date, call- sign, 
frequency, and, in case known, area.'iwhere used. 


8) Captured documents. These were of little value fur 
practical purposes. They were occasionally interesting 
hecause they gave a general picture of a hasio code, 
which was important, particularly in the case of semi- 
hatted, and hatted codes. 


Following also belong in a crypt anelyt ic section: 
dictionaries (general and signals dictionaries) , list 
of Russian military abbreviations, complete list of 
Russian formations and units, a morse code to check 
mistakes in interception. 
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Cryptanalysis of 5-figure additive code 
"Entzif ferung des ueberwurmten 52 - Codes" 
by Uff z HEINZ ALTHANS (NAAST) , 


Succesful Cryptanalysis is possible only if 

1) there are a number of messages, at least three, 
which have had the same additive applied, 

2) the 5-figure code was captured. 

Cryptanalysis starts from the mathematical rule 
that the difference between 2 code groups remains constant if 
both have had the same additive row applied to them. 


Cipher group 
59390 
1 6491 
“41 90 9“ 


For example. 

Code group Additive 

98315 20186 

Difference 41 909 


The most important crypt analytic aid was therefore 
the catalogue of differences, a numerically arranged table 
of the differences between the most frequently used code groups. 

Directly the code (which changed approx, semiannually) 
was captured, about 1000 frequently used clear groups 
(Positionen) were written out by Gen, d, N.A., arranged and 
serially numbered according to frequency, and then each 
subtracted from the other, non- carrying , by Hollerith machines, 
and entries made on the catalogue as follows; 

"41 909 1 7 - 32" 

which means; Nr, 17 u 39214 

1_ 32 TUPE 98315 

Difference 41 909 

In the year 1943 KONA 1 for a period did 5-figure 
cryptanalysis^ independently (of Gen d, N.A.). For this 
purpose a difference catalogue of 200 clear groups ( = 19900 
differences) was compiled by hand. 


Calculation aid: A wooden frame with 5 paper belted 
wheels, I to V, - (1 wheel for each digit of the 5-figure group) 
Marking of the wheels, 


( + The 0 column 
contains in each 
instance the first 

digit of the 50 




0 12 3 

rjr 9 0 


4 5 6 7 8 9 

1 2 3 4 5 


345678901 2 

9012345676 

■7ft0A40»l. 


e c. 
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On wheel II in each instance the 2nd digit of the code 
group stood in the 0 column, etc. 

Use of the apparatus: 

The reciprocal value of a >. 
code group is set 'up shove 
the line by turning the 
wheels , 

e.g. 473 96 corresponds to 

63714 = C. 

The 50 differences between 
the latter 0 and the 50 * ’■ 
selected clear groups will then 
be aut omat ically 
underneath. _ 


For example, 

62158 =0-1 3ntry in the catalogue 48952 1-0 
49017 = G - 3 i! " " 49017 0-3 

The apparatus also serves as an aid in actual decoding, 
vrtien a great deal of non-carrying addition or subtraction 
must be done. 




Survey of Successes in Or 

■ypt analysis 

Type of 



o./o Remarks 

Message 

Intercepted 

Dealt with 

2-figure 

I/ 4 O 

1 25 

90 

3-figure 

6 , 000 

2,600 

43 

4-figure 

5,000 

1 ,900 

38 

Mixed 

2 ,350 

865 

37 

T otal 

13,500 

5,500 

41 = Degree of crypt- 
analtic success. 

Olear Text 

6,000 

6 ,000 

100 

Practice 

500 

500 

100 

Grand total 

intercepted le 

S3 


5-figure & 
NcK.;/,Bc 

20,000 

1 2,000 

60 

5-figure 

8,000 

— 

- Not studied at KONA 1 

N.K.W.D. 

2,000 

- 

- Only partially 
studied at KONA 1. 

Grand Total 

30,000 




Figures are estimated monthly average for year 1944* 
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SPRING A ND PALL: CHAN GD OP 5- J7IGURE CODE , 

"Fruehlung and Herts t; Wechsel des 5Z-Codes u , 
"by Hptm. ' Roman ROSSLiUR. 


O/S Systems: 

« 

4-letter - April 42 
3 -letter - April 43 

* 

RBT - June 44 

RT44 - July 44- 

# 

February 43. KC 42 replaced by PT 43 (only for 
procedure messages# no. more spelling). 
Appearance of addresses; replacement of 
indicators ( 5 -figure). 

June 43. Appearance of Signal Codes. 

January 45. Cryptanalysis: Intensified multiple 

and serial^ encipherment. 

+ Translator/lnterrogato^s note: i.EHRFACH und 
BAHBBSZIPPilRUNG, Verbally explained as follows* 

If a code is so arranged that many different 
figures (say 1 , 3 » 8 , 9 ) can indicate a line or column, 
the Germans say it is mehrf ach- beziff ert. 

If the tiamu can be indicated by ,, 17-24 ,, or 
"27 - 32 " (i.e# by any number between 17 and 24 # 

27 and 32 ) it is band-beziffert. 


& fes 


If-* 
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Study of N. K.W.D, Traffic. 

"Bearbeitung von NKV/D-Verkehren" , 
by Lt, Edward WOELLNER. 


N. K.W.D. traffic was always covered! but only by 
long Range Sigint, Evaluation and Crypt analysis were done by 
NAAS. 

Vifhen W/T traffic was restricted during .// T silences, 
•K.W.D. traffic was often the most important source for 
iginte At such times, it was more completely covered. 

ViiunArmy W/t was in full swing, coverage of N.K. „• • D 0 was 
correspondingly reduced. On an average 6-12 receivers were 
employed exclusively on U. K.W.D. cover. 

In general the following nets were covered: 

1) Chief (N, K.W.D.) authority in MOSCOW with (N» K.W.D, at) 
the Front HQs. 

Reason: The (N, K.W.D.) W/T picture, gave indications 
of groupings, or the insertion of new Fronts. For example, 
appearance of a new W/T station communicating with 1st and 
2nd Ukrainian Fronts- showed that the 4th Ukrainian Front 
had been inserted between the 1st and 2nd Ukrainian Fronts. 
In addition the (new) Front HQ. could be fixed by D/FT 

2) Front staffs with the "Grenztruppen 11 Regiments, 

Reason: D/F of the Regiments revealed the aijproximate 
extent of the Front; D/F of the Chief of Security Troops 
with the Front High Command indicated the location of the 
Front HQ, Besides, when a (forward) echelon of the Chief 
of Security Troops with the Front HQ appeared, it was 
possible to deduce that the Front HQ would move. This, on 
the basis of N, K.W.D* traffic alone. 

3) Regiments to Battalions* 

Reason: Most of the messages could be read; they 
mentioned Army units by name, e.g. , 

(a) Before the attack from the NEISSE sector (1st 
Ukrainian Front) , a 2nd Army and 3rd and 4th Field 
Replacement Rifle Regiment were mentioned by III Bn, 
of the 83rd “Grenztruppen" Regiment (operating in 
GOERLIT2 area) , 

Conclusion: 2nd Polish Army newly brought up to 

the NEISSE sector. 

(b) Lines of advance and boundaries of battalions 
were mentioned. Battalion boundaries often proved 
to be Army boundaries. 

Traffic of rear N.K.vV.D, troops and of the Signals 
Regiments were of no interest, and were not covered by 
KONA 1. 

For technical details of N.K. :.D. traffic and its 
characteristics, see "N. K.W.D." 


Authority yW Z'ZXZ'Z 
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Characteristics of NcK.l/.D, Traffic 
by Gefr, Leonhard. HUGHTING (Peute 10)* 


The traffic of the N.K.W.D* formed a special group 
of Russian, wireless traffic* The distinction applied equally 
to the manner of conducting traffic and to the messages themselves- 

Pour-figure and five-figure N.K.W.D. messages could be 
easily distinguished by their characteristics from Army and Air 
Porce messages. The first group is a discriminent which in most 
cases remains constant for one line of traffic. The penultimate 
group contains the date and a number representing the number of 
groups in the message less a variable number according to the 
number of indicator groups used. The last group is the Chi- 
number (see 5-figure Card Index), Exceptions to these rules 
are very rare. Two and three -figure messages usually contained 
technical' wireless chat'. 

Operators could usually distinguish N,..K 0 ./,D, traffic 
from other Russian types of traffic. 

The letters NK are given in the preamble, but tuning 
is not carried out by keying t! V” as is the practice with 
international and other Russian traffic but by a simple series 
of dots and dashes. 

The wireless networks could be divided into two main 

groups 

1) Networks of the Central Authority 

2) Networks of Formations, 

1) The Central Authority’s Networks can be further 
subdivided into: 

(a) Central Authority of the Security troops, 

(b) Central Authority of the "Grenztruppen". 

(c) Central Authority of the Security troops (Bivisions 
and Brigades of the back areas). 

(d) Central Authority of the Railway troops, 

A constant watch was kept on the (a) Networks* They 
consisted of the communications between the Central 
Authority of the N«K.W#D, in .MOSCOW and, the commanders of 
the Security troops working with the Army Groups, the 
directing staffs North and South, the less interesting 
independent GHQ Signals Regiments. 

The messages were not readable. 

Apart from the characteristics already noted they 
were also to be recojpiised by their use of Call-signs 
which were made up from a square 


The actual Russian wireless station numbers wyre: 
08-12 Central Authority i OROnw. 


DECLASSIFIED 

Authority ^ 




ji-u Hi.-'- 3 ^..aisa.tsu ri-uno, 

24 " il 2nd Baltic Front. 

25 ‘ f " 1st White Russian Front, 

26 11 1st Ukraine Front. 

27 n 11 3rd n 11 

28 Higher directing Staff in LODZ. 

29 F'ont Staff 4th Ukraine Front. 

49 - 65< 1 - 17 Independent GBQ, Signals Regiments. 

61 Directing Staff North (MINSK) • 

64 Front Stuff 2nd Ukraine Front. 

85 Directing Stt:ff South. 

8? Higher directing staff ( 7) Area Bast of STANISLAW. 
80 Ur, icto nt if led. 


Method of working was controlled Kreis working. The 
Kreise were known "by the number of the Controlling station. 
They were, 

Kreis VIII Station 08 with 21,23*24 Night Frequency 

3170/3330 Kcs. 


Kreis IX 

Kreis X 
Kreis XI 

Kreis XII 


" 09 with 20 ,2'* ,25 , 28 Night Frequency 

3850/4180 Kcs. 

" 10 with 81 ,85 Night Freq. 3950/4230 Kcs 

" 11 with 26*29,87 Night Freq. 4580/4940 " 

Day Frequency 7400/8670 Kcs. 

Station 12 with 27,84 Night Freq, 4580/4940 Kcs, 


Kreis LXXXI Station 81 with 20.21 ,22,23, 24,25,28, 49*50, 

55,57# 59,60,61,63,65. Night Freq, 2850/2975 Kc- 
Day Frequency 4080/4480 Kcs. 


Kreis LXXXV Station 85 with 26,27,29,51 ,52 ,53 ,54,56 ,58 , 
62,64,80,84,87, Night Freq, 2700/3050 Kcs, 
Day Frequency 3950/4400 Kcs. 


2) Formation Networks consist of the communications 
between commanders of the security troops at Front Staffs 
and their regiments and between the latter and their 
battalions. Messages passed in these networks were for 
the most part readable. 


On the front watched by us the following units were 
identified reading from South to North, 

4th Ukraine Front 92, 30(7), (80?) and 215 "Grenztruppen" 

Regiments. 

1st Ukraine Front 18, 88, and 333 "Grenztruppen" Regiments. 


1st White Russian Front 127,157 end 38 


Cal l- sig n U sage , 

Call-signs were mostly pronouneable. The Front Staff 
networks usually changed their cell-signs daily, the Regiment 
networks at regular intervals of several days, in many cases 
of weeks. 

Frequencies used loy mainly between 2400 & 3600 Kcs. 

It should be mentioned that 5-figure N.K.W.D. messages 
have been picked up in nets identified as belonging to the Army 
or the Air Force, such messages contained SM3RSCH in the 
preamble Such messages were originated by units of the Counter 
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transmit their messages. 

The fourth group from the end of such messages had. 
a special characteristic. The second higram was the same 
as the first reversed and the fifth figure was a constant. 

Ex* 14412. 

Networks in which suoh messages were sent were not to 
he regarded as N,K,W,D, networks 


DECLASSIFIED 
Authority V ^ X 
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N.K.V/.D* - Codes. 

"by Obergefr. Georg THOM A 3 . ( HA/lS ) . 


Rli Z 0 1 800 has since October 1943 had 50 pages, 
each consisting of 50 lines and totalling 2,500 clear groups, 
alphabetically arranged, Each page is shifted by means of 
’’Chiffranten" and the bigrams (ab and cd) are then replaced 
by others according to substitution tables. 

Shift ing b y mean s of Ch iff rant e n enciphering: 

Any figure, chosen from Rev* A "("sample code i'n .limcxe 1), 
will indicate on any page, in Row B below, the figure which must 
be added to that standing beside the clear group (and 
subtracted when deciphering). 

Su bstit uti o n o f bi p ram s: For the first and second 
halves of t h e~~4-f i gur e ~g"r o up (elements ab and od) there are 
substitution tables, each of which contains 100 bi grams (each 
bigram, from Ol to 50 occurs tv/ice) 0 There are 10 such 
tables (numbered for the most part from 0 to 9) ■. Sample b elow tJ 

The reoiphering is indicated by a 4-figure group 
(indicator) which appears at a definite position in the 
message and contains, 

1) Humber of the clear-group table (indicated with two 
digits) 

2) Ghiffrant 

3) Number of the pagination to ole, 

Example: 

Indicator 0151 

Chigruppe 2406. 

Decipher me nt (accord ing t o 'tnB Xeo b rAe ;/) i 

Element ab (-24) yields 20 according to the 
pagination table. The clear-group therefore is on page 20. 
Element cd yields 02 according to the clear-group table. 

From this the chiffrant is subtracted, in this case 1 (the 
number on page 20 under the fixed figure 5). Thus the clear 
group 2001 = Komandirowat 1 is derived, 

R4 Z 0 4 was used from 1933 (solved 1940) until 
1942, There were 100 pages each with 100 clear greups arranged 
alphabetically. Recipherment by means of 31 substitution 
tables. 


i’ 


r. 
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Bigi'om suhsti.* n.tiwi table for Rh Z C 1 OCX), 

ft 

(Por deciphering; for enciphering tables , the encipher 
version of the same table Is used.) 


0 

1 

2 

3 

4 

5 

6 

7 

8 

.9 


49 

37 

50 

21 

13 

36 

02 

10 

18 

16 

47 

22. 

31 




J 

|. ^ 


etc. 






















1 


1 









! 


















































Clear group table 
No* 1 

(for element cd) 


0 

1 

2 

3 

4 

5 

6 

7 

8 


01 23456789 


15 


28 


37 


50 


20 


25 


18 


07 


11 etc 


49 S9 


Pagination table No*1 
(for element ab) 


9 
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Study of Russian Air Force Traffics , 
"Bearbeitung von Luf twaff enverkehren", 
by Lt. 3 dward WGELLNiSR (BAAS). 


Air traffic was, in principle , not covered, and 
cover was dropped by the Companies as soon as a traffic was 
recognised as Air. For this purpose, data on ,dr as well as 
Array traffic had to be kept in the card indexes. These 
statistics included such as were derived from air traffic taken 
"by mistake"; also date, supplied by the G.A.F, Sigint, 
Atioil,.ngen III/ 353 (Luf tflotte 4) and 11/353 (Luf tf lotto 6), 
which were passed on by the NAAS to the Long Range Sigint, 
Companies. The Companies kept air data in the Army card index, 
but the NAAS had special indexes (similar to the Army indexes). 
N.'dS had a section "Air Force". 

The "Air Force" section of NIAS had the following 

tasks : 

1) Collection of "Air Force" data; passing of such data 
to the Long Range Sigint, Companies. 

2) interpretation of Air traffic not recognised as Air 
by the Companies. 

3) Forwarding of now Air traffic picked up in search to 
the competent G,A,F* Sigint, Abteilung, 

4) Passing of particularly .interesting messages to the 
G.A.F. Sigint, Abteilungen, 

5) exploitation of /dr signals indicating intentions and 
battle order of ^rmy fo mat ions, 

S) Compilation of the 'dir" section of the (..rmy) Sigint, 

Sit rep, (based on reports of the G.A.F. Sigint, Ab toil ungen 
and our own material). 

In some exceptional cases, G.A.F* traffic was also 
expressly covered: 

(a) When signals links tp the G.A»F« Sigint, 

Abteilung, for example, were cut. During such a period 
we recognised concentrations and movements on the 

1st Ukrainian Front from’ cover of I Guards Ground 
Attack Air Corps. 

♦ v * 

(b) During large-scale operations, .the routes of 
advanco of armoured Corps were worked out from 

s i rmals ■ in /dr nets. 


